What is claimed is: 

1. A network system comprising: 
a plurality of sub-networks; 

an authentication server for authenticating a client in 
one of the plurality of sub-networks in response to an 
authentication request of the client when establishing a 
communication session for packet communication between the 
terminal of the client and a different sub-network as a client's 
target; 

an address processing unit for executing, after the 
authentication by the authentication server and on the basis 
of an instruction from the authentication server, an address 
processing of packet signals in packet communication between 
the client 1 s terminal and the sub-network as the client 1 s target . 

2. The network access system according to claim 1, 
wherein: 

the authentication request from the client includes data 
of the sub-network as the client's target. 

3 . The network access system according to one of claims 
1 and 2, wherein: 

the authentication server has a correspondence table 
provided for each client and showing one or more sub-networks 
as client 1 s targets and specifies the sub-network as the client ' s 
target on the basis of the correspondence table, and an address 
translation table showing the correspondence between data 
specifying the communication session on the packet signal and 
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address data corresponding to the sub-network as the client's 
target, is set in the address processing unit. 

4. The network access system according to claim 3, 
wherein: 

the client's terminal sends out the packet signal by 
setting the address of the address processing unit as destination 
address; and 

the address processing unit specifies the sub-network 
as the client's target on the basis of the data specifying the 
communication session on the packet signal in the address 
translation table, and translates the destination address of 
the packet signal to address data corresponding to the specified 
sub-network . 

5. The network access system according to one of claims 
3 and 4, wherein: 

the source address is used as the data specifying the 
communication session on the packet signal. 

6. The network access system according to claim 5, 
wherein: 

session discrimination data is set on the packet signal 
as at least part of the data specifying the communication session . 

7. The network access system according to one of claims 
1 to 6, wherein: 

the address processing unit receiving a packet signal 



39 



addressed to the client from the sub-network as the client's 
target, translates the source address of the packet signal to 
the own address and sends out resultant packet signal. 

8. The network access system according to one of claims 
1 to 7, wherein: 

the sub-network has a gateway unit, and the address of 
the gateway unit is used as the address corresponding to the 
sub-network. 

9. The network access system according to claim 8, 
wherein: 

the gateway unit and the client terminal have a function 
of tunnel communication with respect to the packet signal having 
been capsulated by adding a capsulation header describing the 
address; and 

the gateway unit deletes the capsulation header from the 
packet signal addressed to the gateway unit and feeds the 
resultant packet signal to the own sub-network. 

10. The network access system according to claim 9, 
wherein: 

the gateway unit records, in correspondence to one another, 
the source address of the packet signal addressed to its own 
in the capsulation header and the address assigned to the client 1 s 
terminal in the own network, and when detecting a packet signal 
with the correspondence address as the destination address, 
capsulates the packet signal by setting the source address in 
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the capsulation header that is made to correspond to the 
correspondence address as the destination address of the packet 
signal and also setting the own address as the source address 
of the packet signal for sending out the packet signal. 

11 . The network access system according to one of claims 
1 to 10, wherein: 

a plurality of the sub-networks are connected to 
pluralities of authentication servers and each have a proxi 
authentication server; 

the client T s terminal executes the request of the client 
authentication by accessing the proxi authentication server; 
and 

the proxi authentication server specifies the 
authentication server of the sub-network as the client's target 
on the basis of the authentication request from the client, 
inquires the specified authentication server about whether the 
authentication is possible or not, and when the client is 
certified by the authentication server allows the client's 
accessing. 

12 . The network access system according to one of claims 
6 and 11, wherein: 

the authentication server issues session discrimination 
data specifying the communication session to the terminal of 
the client certified either directly by it or via the proxi 
authentication server; and 

the client's terminal adds the session discrimination 
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data issued from the authentication server to the packet signal . 



13 . The network access system according to one of claims 
1 to 12, wherein: 

the authentication server reports, at the time of the 
client authentication, the address of the address processing 
unit to be accessed to the terminal of the pertinent client; 
and 

the client terminal executes packet communication with 
the sub-network as the client 1 s target via the address processing 
unit reported from the authentication server. 

14 . The network access system according to one of claims 
1 to 13, wherein : 

the sub-network has a gateway unit positioned as the 
client; and 

the gateway unit executes tunnel communication of the 
capsulated packet signal with the sub-network as the target 
of the client in the own sub-network, executes, when receiving 
an authentication request for the communication session 
establishment from the client in the Own sub-network, the client 
authentication request to the authentication server in lieu 
of the client, and uses session discrimination data for 
specifying the communication session as at least part of the 
data specifying the communication session on the packet signal . 

15. The network access system according to claim 14, 
wherein: 
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the server reports, in response to the client 
authentication request from the gateway unit, the data specif ying 
the address of the sub-network as the client's target to the 
gateway unit; and 

when the gateway unit detects the packet signal addressed 
to the sub-network as the client's target on the basis of the 
data reported from the authentication server, it specifies the 
client from the source addresses of the packet signal, and when 
it confirms that the specified client has received the 
authentication for the communication session establishment, 
it capsulates the packet signal by setting the session 
discrimination data in part of the capsulation header and sends 
out the capsulated packet signal to the address processing unit. 

16. A network access system in which an authentication 
server executes authentication of a client in an open network 
in response to an authentication request from the client at 
the time of the accessing of a department network by the client, 
andanaddressprocessingunit executes, after the authentication 
of the client by the authentication server and on the basis 
of an instruction from the authentication server, an address 
processing of packet signal concerning packet communication 
between the client and the department network. 
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